CVE-2026-16302— Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
Quick assessment
Affected
brainstormforce Spectra Legacy – Gutenberg Blocks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 Spectra Legacy – Gutenberg Blocks 在所有 2.20.0 及以下版本中存在敏感信息泄露漏洞。该漏洞通过 函数导致安全问题，该函数在未进行权限检查的情况下，通过 对象暴露了 配置项。这使得拥有 Contributor 级别或更高权限的攻击者能够提取管理员配置的原始 Instagram Graph API 访问令牌等敏感数据。要利用此漏洞，必须同时启用 Spectra Pro 插件并关联一个 Instagram 账户。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| brainstormforce | Spectra Legacy – Gutenberg Blocks | ≤ 2.20.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16302
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| brainstormforce | Spectra Legacy – Gutenberg Blocks | 0 ~ 2.20.0 | - |
|
II. Public POCs for CVE-2026-16302
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16302
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16302 (1)
IV. Related Vulnerabilities
Same vendor: brainstormforce
-
CVE-2026-18406
SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-18402
SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cro -
CVE-2026-7623
SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cro -
CVE-2026-15821
SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cro -
CVE-2026-15787
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Cont
Same weakness: CWE-200
-
CVE-2026-101092
SiYuan before v3.8.4 Information Disclosure via getCurrentAt -
CVE-2026-101146
Eleveo Quality Management GWT RPC QMUtilsService UtilsServic -
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS -
CVE-2026-101143
Eleveo Quality Management QMBODownload information disclosur -
CVE-2026-101083
PMWeb encryptionhelper.dll information disclosure
V. Comments for CVE-2026-16302
No comments yet